class_docstr: Class to retrieve IOCs from ThreatStream.com and store them in DynamoDB
docstr: Process and filter data by sources and keys
  Args:
      data (list): A list contains ioc information
          Example:
              [
                  {
                      'value': 'malicious_domain.com',
                      'itype': 'c2_domain',
                      'source': 'crowdstrike',
                      'type': 'domain',
                      'expiration_ts': '2017-12-19T04:45:18.412Z',
                      'key1': 'value1',
                      'key2': 'value2',
                      ...
                  },
                  {
                      'value': 'malicious_domain2.com',
                      'itype': 'c2_domain',
                      'source': 'ioc_source2',
                      'type': 'domain',
                      'expiration_ts': '2017-12-31T04:45:18.412Z',
                      'key1': 'value1',
                      'key2': 'value2',
                      ...
                  }
              ]
  
  Returns:
      (list): A list of dict contains useful IOC information
          Example:
              [
                  {
                      'value': 'malicious_domain.com',
                      'itype': 'c2_domain',
                      'source': 'crowdstrike',
                      'type': 'domain',
                      'expiration_ts': 1513658718,
                  }
              ]
docstr_tok: ["Process","and","filter","data","by","sources","and","keys","Args",":","data","(","list",")",":","A","list","contains","ioc","information","Example",":","[","{","'value","'",":","'malicious_domain.com","'",",","'itype","'",":","'c2_domain","'",",","'source","'",":","'crowdstrike","'",",","'type","'",":","'domain","'",",","'expiration_ts","'",":","'2017-12-19T04:45:18.412Z","'",",","'key1","'",":","'value1","'",",","'key2","'",":","'value2","'",",","...","}",",","{","'value","'",":","'malicious_domain2.com","'",",","'itype","'",":","'c2_domain","'",",","'source","'",":","'ioc_source2","'",",","'type","'",":","'domain","'",",","'expiration_ts","'",":","'2017-12-31T04:45:18.412Z","'",",","'key1","'",":","'value1","'",",","'key2","'",":","'value2","'",",","...","}","]","Returns",":","(","list",")",":","A","list","of","dict","contains","useful","IOC","information","Example",":","[","{","'value","'",":","'malicious_domain.com","'",",","'itype","'",":","'c2_domain","'",",","'source","'",":","'crowdstrike","'",",","'type","'",":","'domain","'",",","'expiration_ts","'",":","1513658718",",","}","]"]
code: def _process_data(self, data):
      """Process and filter data by sources and keys
      Args:
          data (list): A list contains ioc information
              Example:
                  [
                      {
                          'value': 'malicious_domain.com',
                          'itype': 'c2_domain',
                          'source': 'crowdstrike',
                          'type': 'domain',
                          'expiration_ts': '2017-12-19T04:45:18.412Z',
                          'key1': 'value1',
                          'key2': 'value2',
                          ...
                      },
                      {
                          'value': 'malicious_domain2.com',
                          'itype': 'c2_domain',
                          'source': 'ioc_source2',
                          'type': 'domain',
                          'expiration_ts': '2017-12-31T04:45:18.412Z',
                          'key1': 'value1',
                          'key2': 'value2',
                          ...
                      }
                  ]
  
      Returns:
          (list): A list of dict contains useful IOC information
              Example:
                  [
                      {
                          'value': 'malicious_domain.com',
                          'itype': 'c2_domain',
                          'source': 'crowdstrike',
                          'type': 'domain',
                          'expiration_ts': 1513658718,
                      }
                  ]
      """
      results = list()
      for obj in data:
          for source in self.ioc_sources:
              if source in obj["source"].lower():
                  filtered_obj = {
                      key: value
                      for key, value in obj.items()
                      if key in self.ioc_keys
                  }
                  filtered_obj["expiration_ts"] = self._epoch_time(
                      filtered_obj["expiration_ts"]
                  )
                  results.append(filtered_obj)
      return results
  
imports: from datetime import datetime, timedelta
  import json
  import backoff
  import boto3
  from botocore.exceptions import ClientError
  import requests
  from streamalert.shared.backoff_handlers import backoff_handler, success_handler, giveup_handler
  from streamalert.shared.config import load_config, parse_lambda_arn
  from streamalert.shared.logger import get_logger
  from streamalert.threat_intel_downloader.exceptions import ThreatStreamCredsError, ThreatStreamLambdaInvokeError, ThreatStreamRequestsError
label_desc: Use image node_id 8 for calling the ThreatStream obj's underlying member method code with example usage: obj._process_data(data) and returns: results